@kensaurus/skills 0.0.0-stage → 2.1.0

package/skills/audit-performance/references/loading-priority-2026.md

@@ -0,0 +1,81 @@
+# Loading priority & speculation (2026)
+
+Depth for `audit-performance` §Loading Priority & Speculation.
+Implement instant navigations in `enhance-web-instant-nav`.
+
+## LCP discoverability
+
+The LCP resource must be in the first HTML. Failures:
+
+- `loading="lazy"` on the hero
+- CSS `background-image` (not a discoverable request)
+- Client-only `<img>` after hydration
+- Missing `fetchpriority="high"` / `<Image priority />`
+
+Preload responsive LCP images:
+
+```html
+<link rel="preload" as="image" imagesrcset="…" imagesizes="…" fetchpriority="high">
+```
+
+## Fonts and CLS
+
+`next/font` injects fallback metrics (`size-adjust`, `ascent-override`).
+If you self-host `@font-face`, set those overrides or swap causes CLS.
+Preload only the above-fold weight.
+
+## 103 Early Hints
+
+Emit on HTML only, ≤ ~5 hints: preconnect CDNs + preload LCP image + critical CSS.
+
+```bash
+curl -sv https://example.com/ 2>&1 | grep -E "< HTTP/.* 103"
+```
+
+Node: `res.writeEarlyHints({ link: [...] })`. CDN: Cloudflare/Fastly Early Hints
+reads origin `Link` headers. See `enhance-web-instant-nav/references/early-hints.md`.
+
+## Speculation Rules
+
+Prefetch in-site links at `moderate`. Prerender only high-probability next pages.
+Never speculate logout/cart/checkout/auth or GET-with-side-effects.
+Guard servers with `Sec-Purpose` and clients with `document.prerendering`.
+
+## bfcache
+
+Blockers: `unload`, `Cache-Control: no-store` on HTML, open WebSocket/IDB at
+`pagehide`. Test: DevTools → Application → Back/forward cache.
+
+## Verification
+
+```bash
+npx @lhci/cli autorun --config=lighthouserc.json
+```
+
+Field p75 (CrUX/PSI) is pass/fail. Lab is diagnosis.
+
+## Budgets
+
+`budget.json` starter (fail the PR on regression):
+
+```json
+[{
+  "path": "/*",
+  "timings": [
+    { "metric": "largest-contentful-paint", "budget": 2500 },
+    { "metric": "cumulative-layout-shift", "budget": 0.1 },
+    { "metric": "total-blocking-time", "budget": 200 }
+  ],
+  "resourceSizes": [
+    { "resourceType": "script", "budget": 300 },
+    { "resourceType": "image", "budget": 500 },
+    { "resourceType": "third-party", "budget": 150 }
+  ],
+  "resourceCounts": [
+    { "resourceType": "third-party", "budget": 5 }
+  ]
+}]
+```
+
+Definition of done for a perf PR: before/after field or lab numbers, LCP
+element named, budgets green in CI.

package/skills/audit-realworld/SKILL.md

@@ -0,0 +1,287 @@
+---
+name: audit-realworld
+description: >
+  Read-only conformance audit of a full-stack app against RealWorld
+  ("Conduit"): API spec, shared E2E suite, closest-stack reference. Use when
+  "audit against RealWorld", "Conduit conformance", or "is my full-stack app
+  complete?".
+license: MIT
+effort: high
+---
+
+# audit-realworld — Full-Stack Gap Audit vs the RealWorld Reference
+
+**Degree of freedom: MIXED** — Mode, parity, and routing `[HIGH freedom]`;
+Phase 4 contract-suite run `[LOW freedom — run exactly]` when a server or
+suite exists.
+
+Read-only. Findings and a prioritized gap report only — no code changes.
+Remediation goes to the skill named per finding.
+
+RealWorld ("Conduit") is an objectively testable full-stack benchmark: formal
+API spec, shared E2E suite, shared CSS theme, hosted API at
+`api.realworld.show`.
+
+> **The RealWorld API spec and its E2E suite are the source of truth — not any
+> single community implementation.** Reference repos vary; the spec and the
+> passing suite do not.
+
+> **RealWorld is a demo spec, not a production bar.** It omits rate limiting,
+> observability, caching, CI/CD, secrets, and deployment. Report *feature/
+> pattern parity*, then delegate hardening to `audit-security`,
+> `plan-security-audit`, `plan-perf-audit`, `plan-rls-audit`, and
+> `full-stack-ship-discipline`.
+
+## How to reason — Observe → Interpret → Classify → Severity
+
+1. **Observe** — quote the spec contract (or pattern) and the repo's `file:line` (or suite result)
+2. **Interpret** — does this layer implement the contract, or only the UI/route?
+3. **Classify** — Implemented / Partial / Missing / Diverges — or Bow-out if the repo is not a web CRUD+auth app
+4. **Severity** — core Conduit / authz / list-contract gaps = High; production-omitted concerns are routed, not scored as RealWorld misses
+
+## Worked example
+
+> **Observe:** Conformance mode. `GET /api/articles` returns `{ articles }`
+> with no `articlesCount` and no `limit`/`offset` (`app/api/articles/route.ts`).
+> Bruno list request fails the count assertion. Auth header is `Token <jwt>`.
+> **Interpret:** the list contract is partial; clients cannot paginate. Auth
+> scheme matches the spec.
+> **Classify:** Partial (pagination / `articlesCount`); auth Implemented.
+> **Severity:** High — feed is a core Conduit surface.
+> **Finding:** Article list | no pagination / articlesCount | High | complete-everything
+
+---
+
+## Phase 0 — Detect the stack and gate applicability  [HIGH freedom]
+
+Read the dependency manifest and source before comparing anything (reuse the
+`audit-fe-api` detection approach).
+
+### 0a. Classify the stack
+
+- **Frontend:** framework (React/Next/Vue/Nuxt/Svelte/Angular/Solid), router,
+  state/data layer (TanStack Query, SWR, RTK, Pinia), HTTP client.
+- **Backend:** framework (Express/Hono/Fastify/Nitro/NestJS/Django/Rails/Go/
+  Laravel/Spring), routing style, auth mechanism.
+- **Data layer:** database + ORM/query builder (Prisma/Drizzle/TypeORM/Sequelize/
+  SQLAlchemy/ActiveRecord/Supabase), migration tool.
+- **Tests:** unit runner, and any API/E2E harness (Bruno, Hurl, Postman/Newman,
+  Playwright, Cypress).
+
+### 0b. Applicability gate
+
+Decide the mode — state which one and why, out loud:
+
+| Condition | Mode |
+|---|---|
+| Repo is a RealWorld/Conduit build (articles, profiles, favorites/follow, tags, JWT `Token` scheme) | **Conformance** |
+| Web full-stack CRUD app with auth + owned resources, but a different domain | **Benchmark** |
+| Not a web app, no HTTP API, no auth/resources (CLI, library, static site, pure ML) | **Bow out** |
+
+**If you bow out, say so plainly** and recommend the fitting skills instead
+(`audit-security`, `audit-performance`, `plan-perf-audit`, `audit-code-quality`,
+`audit-fe-api`). Do not force a RealWorld comparison onto a repo it does not fit.
+
+### 0c. Record the discovery
+
+```
+STACK: FE=<...> · BE=<...> · DB/ORM=<...> · tests=<...>
+MODE: Conformance | Benchmark | Bow-out (reason)
+RealWorld reference chosen: <stack impl> (spec-compliant? maintained?)
+```
+
+---
+
+## Phase 1 — Pull the reference (current)  [HIGH freedom]
+
+### 1a. Spec + test suite (source of truth)
+
+- API spec and shared E2E suite live in the `realworld-apps/realworld` repo
+  (`specs/`, Bruno `.bru`, Hurl `.hurl`) with a Postman collection for endpoint
+  testing. The hosted API at `api.realworld.show` needs no keys.
+- Fetch the current spec and note the exact endpoint/response/error contracts
+  (summarized in Phase 2). Recognizing RealWorld is not knowing its current
+  endpoint contracts — read the spec as published, not from memory.
+
+### 1b. Closest-stack reference implementation
+
+- Find the nearest implementation on `codebase.show/projects/realworld`, filter
+  by the detected FE/BE stack. **Prefer spec-compliant, recently maintained
+  implementations** (only a subset are verified spec-compliant at any time).
+- Treat the reference as a *pattern* yardstick (folder structure, auth wiring,
+  validation, error mapping) — not as gospel. When the reference and the spec
+  disagree, the spec wins.
+
+### 1c. Research current best practices
+
+Follow the `/research` protocol for the detected stack (Context7 for library
+docs; Firecrawl for current patterns, dated to now). Anchor recommendations to
+the versions actually installed in the repo.
+
+---
+
+## Phase 2 — Parity / pattern matrix  [HIGH freedom]
+
+### Conformance mode — audit against the RealWorld contract
+
+Enumerate the spec surface and mark each **Implemented / Partial / Missing /
+Diverges**, with `file:line` evidence:
+
+**Auth & users**
+- `POST /api/users` (register), `POST /api/users/login`
+- `GET /api/user`, `PUT /api/user` (current user)
+- Auth header scheme: `Authorization: Token <jwt>` (not `Bearer`)
+
+**Profiles**
+- `GET /api/profiles/:username`
+- `POST` / `DELETE /api/profiles/:username/follow`
+
+**Articles**
+- `GET /api/articles` (filters: `tag`, `author`, `favorited`, `limit`, `offset`)
+- `GET /api/articles/feed` (auth, followed authors)
+- `GET` / `POST` / `PUT` / `DELETE /api/articles/:slug`
+- `POST` / `DELETE /api/articles/:slug/favorite`
+
+**Comments & tags**
+- `GET` / `POST /api/articles/:slug/comments`, `DELETE .../comments/:id`
+- `GET /api/tags`
+
+**Cross-cutting contracts**
+- Response envelopes: `{ user }`, `{ profile }`, `{ article }`,
+  `{ articles, articlesCount }`, `{ comment(s) }`, `{ tags }`
+- Validation errors: `422` with `{ "errors": { "body": [ ... ] } }`
+- Auth failures: `401`; missing resources: `404`
+- Pagination: `limit` / `offset`, with `articlesCount` for lists
+- Slug generation, `favoritesCount`, `following`/`favorited` booleans reflect
+  the requesting user
+
+### Benchmark mode — map the patterns onto the repo's own domain
+
+The repo isn't Conduit, so audit whether it exhibits the same *production-
+relevant patterns* RealWorld demonstrates, for its own resources:
+
+| Pattern | What to check in this repo |
+|---|---|
+| Auth flow | Register/login/current-user; token issue + attach + refresh; protected routes |
+| Owned resources + authz | CRUD on user-owned entities; ownership enforced server-side, not just UI |
+| List semantics | Pagination, filtering, total counts, empty states |
+| Relations | Follow/favorite-style join semantics done correctly (no N+1, correct counts) |
+| Consistent envelopes | Uniform response + error shape across endpoints |
+| Validation | Server-side validation with structured field errors |
+| Contract tests | An API/E2E suite that proves the contract, not just unit tests |
+
+---
+
+## Phase 3 — Full-stack coverage sweep  [HIGH freedom]
+
+Audit all three layers, not just whichever is easiest to read:
+
+- **Frontend:** routes for each resource; auth flow (login/register/logout,
+  token persistence, guarded routes); data layer (caching, error/loading/empty
+  states); forms with validation and server-error surfacing.
+- **Backend:** every spec/pattern endpoint present; auth middleware; input
+  validation; consistent error mapping; pagination; correct status codes.
+- **Data layer:** schema covers the entities and relations; migrations exist and
+  are current; indexes on foreign keys and hot query paths; constraints
+  (unique, not-null, FK) enforce integrity. Verify live via Supabase MCP when
+  applicable.
+- **Tests:** unit coverage on core logic, plus the RealWorld contract suite (or
+  the repo's equivalent E2E harness).
+- **Build/config:** app builds; env contract documented (names only).
+
+---
+
+## Phase 4 — Live conformance test (optional but decisive)  [LOW freedom — run exactly]
+
+If a server is running or the E2E suite is present, run the objective proof:
+
+- Run the RealWorld Bruno collection (`bru run`), the Hurl files
+  (`hurl --test`), or the Postman collection (`newman run`) against the local
+  API base URL. Report pass/fail per endpoint.
+- If no server is available, state exactly how to run it (base URL, seed/demo
+  credentials) rather than guessing conformance from code alone.
+
+A passing contract suite is stronger evidence than any static reading. Save any
+run artifacts under `.playwright-mcp/` if using playwright-cli.
+
+---
+
+## Phase 5 — Production layering (the honest part)  [HIGH freedom]
+
+RealWorld parity is necessary breadth, not sufficient depth. Enumerate what
+RealWorld does **not** cover and route each to the right skill — do not imply
+parity means production-ready:
+
+| Concern RealWorld omits | Route to |
+|---|---|
+| AuthN/AuthZ hardening, secrets, injection, OWASP | `audit-security`, `plan-security-audit` |
+| Row-level security / access control (Supabase) | `plan-rls-audit` |
+| Performance, Core Web Vitals, query cost | `plan-perf-audit`, `audit-performance`, `backend-db-performance` |
+| FE↔BE contract drift and runtime errors | `audit-fe-api`, `debug-fe-be-integration` |
+| Rate limiting, observability, error handling | `backend-observability`, `backend-error-handling` |
+| Deploy + migration/edge-function verification | `full-stack-ship-discipline`, `deploy-verify` |
+
+---
+
+## Phase 6 — Report (read-only)  [HIGH freedom]
+
+```markdown
+## RealWorld Full-Stack Audit — [repo] — [date]
+
+**Mode:** Conformance | Benchmark
+**Stack:** FE [..] · BE [..] · DB/ORM [..] · tests [..]
+**Reference:** [closest-stack impl] (spec-compliant: yes/no)
+**Live contract suite:** ran (N/M passed) | not run — [how to run]
+
+### Implemented correctly
+- [feature/pattern] — [file:line]
+
+### Partial (works but incomplete or diverges)
+| Feature/Pattern | Gap | file:line | Severity | Fix via |
+|---|---|---|---|---|
+| Article feed | No pagination / articlesCount | ... | High | complete-everything |
+
+### Missing
+| Feature/Pattern | file:line (where it should live) | Severity | Fix via |
+|---|---|---|---|
+| DELETE comment authz | ... | High | workflow-fix-and-ship |
+
+### Diverges from spec (Conformance mode)
+| Endpoint | Spec says | Repo does | file:line |
+|---|---|---|---|
+| Auth header | `Token <jwt>` | `Bearer <jwt>` | ... |
+
+### Production gaps (NOT covered by RealWorld — separate hardening)
+- Security → `audit-security` · Perf → `plan-perf-audit` · RLS → `plan-rls-audit` · ...
+
+### Recommended order
+1. [Critical conformance/parity gaps] → complete-everything / workflow-fix-and-ship
+2. [Production hardening] → audit-security → plan-perf-audit → ...
+```
+
+**Forbidden:** claiming production-readiness from RealWorld parity alone;
+inventing conformance without running or precisely describing the contract test;
+silently skipping a layer (FE, BE, or DB).
+
+---
+
+## Self-critique before reporting  [LOW freedom — do not skip]
+
+1. **Evidenced** — `file:line` or suite pass/fail, not "looks like Conduit"
+2. **Mode honest** — Bow-out if no HTTP API + auth + owned resources; do not force a comparison
+3. **Suite honesty** — ran N/M or stated exactly how to run; never invent conformance
+4. **All three layers** — FE, BE, and data; skipping one is a failed audit
+5. **Not production-ready** — RealWorld parity is never a security / perf / RLS pass
+6. **Nothing changed** until approved
+
+## Related
+
+- `audit-fe-api` — FE↔BE contract detail once endpoints are inventoried
+- `debug-fe-be-integration` — reactive debugging of contract mismatches
+- `audit-security` / `plan-security-audit` — the security depth RealWorld omits
+- `plan-rls-audit` — Supabase access control
+- `plan-perf-audit` / `audit-performance` — the performance depth RealWorld omits
+- `test-unit` / `test-playwright` — write the coverage this audit finds missing
+- `complete-everything` — close the parity + hardening gaps to done
+- `workflow-fix-and-ship` — fix a single missing endpoint/feature and ship it
+- `full-stack-ship-discipline` (rule) — migrations/functions must actually deploy

package/skills/audit-registry-listing/SKILL.md

@@ -0,0 +1,122 @@
+---
+name: audit-registry-listing
+description: >
+  Read-only audit of where a repo is found: README first screen, npm/PyPI
+  metadata and tarball, GitHub topics, social preview, plugin manifests. Use
+  when "audit our npm listing", "README as landing page", or "why nobody finds
+  the package". Fix → enhance-readme.
+license: MIT
+effort: high
+---
+
+# audit-registry-listing — The registry is the landing page
+
+**Degree of freedom: MIXED.** What the first screen should say
+`[HIGH freedom]`; the metadata checklist and the tarball check
+`[LOW freedom — run exactly]`.
+
+Read-only. For a package, plugin, skill pack, or CLI, discovery happens in a
+registry and the README's first ten lines are the hero. This skill checks
+every surface a stranger sees before the repo, reports gaps with evidence,
+and hands fixes to the owning skills.
+
+## This skill vs neighbors
+
+| Skill | Owns |
+|---|---|
+| **audit-registry-listing** (this) | Findings on README hero, registry metadata, GitHub surface, manifests, install path |
+| `enhance-readme` | Hero image, tour grid, screenshots — the fix |
+| `docs-writer` | README prose, quickstart wording |
+| `deploy-npm` | The publish itself; `files`/`publishConfig` changes ship through it |
+| `plan-aso` | App Store / Play listings |
+| `enhance-web-seo` | The website, not the registry |
+| `plan-dependency-provenance` | Whether *dependencies* are real — not this package's listing |
+
+Do **not** fire for "make the README prettier" → `enhance-readme`.
+
+## How to reason
+
+1. **Surface** — which registry or page does a stranger hit first for this repo?
+2. **Ten lines** — can they say what it is, for whom, and how to install, before scrolling?
+3. **Metadata** — does the registry card (name, description, keywords, homepage, repo, license) say the same thing?
+4. **Tarball** — does the published artifact contain what the README promises and nothing it should not?
+5. **Path** — install to first success in under a minute, on a clean machine?
+
+## Worked example
+
+> **Surface:** npm page + skills.sh card + GitHub repo.
+> **Ten lines:** README opens with a logo and a count ("145 skills · 57 commands"); the outcome appears in paragraph 3.
+> **Metadata:** npm description repeats the count; GitHub description empty; 4 topics; no social preview; `homepage` points at skills.sh (good).
+> **Tarball:** `npm pack --dry-run` shows `docs/screenshots/` (12 MB) shipping; `llms.txt` present.
+> **Path:** `npx @kensaurus/skills --all` works; first-run message tells the user to restart Cursor — good.
+> **Findings:** hero leads with counts (major → `enhance-readme`/`docs-writer`); GitHub description + preview missing (minor → repo settings); screenshots bloat the tarball (minor → `deploy-npm` `files`).
+
+## Self-critique before reporting
+
+- **Evidence** — every finding quotes the line, field, or `npm pack` output
+- **Stranger test** — the ten-line verdict comes from a fresh-context subagent given only the README's first ten lines and the registry card, nothing else from the repo; this is the one place delegation pays here, because once you have read the repo your own read is no longer a stranger's
+- **No fixes applied** — findings and owners only
+- **Right owner** — visuals → `enhance-readme`; prose → `docs-writer`; `files` → `deploy-npm`; store → `plan-aso`
+
+---
+
+## Checklist  [LOW freedom — run exactly]
+
+### A · README first screen
+- Line 1–10: name, one outcome sentence (not a count), who it is for, install one-liner, one screenshot or terminal GIF.
+- Badges: version, license, one live proof (installs/downloads); no broken or stale badges.
+- Quickstart to first success ≤ 5 steps; a "what it is not" line.
+
+### B · Registry metadata (npm / PyPI / crates / gems)
+- `name`, `description` (outcome-first, ≤ 140 chars), `keywords` (the queries people type), `homepage`, `repository`, `bugs`, `license`, `engines`.
+- README rendered on the registry equals the repo README (or a deliberate short version).
+- `npm pack --dry-run` / `python -m build` listing: everything promised present; no `.env*`, keys, screenshots, tests, or 10 MB+ assets unless intended; `files` whitelist present.
+- `bin` names match the README; `npx <pkg>` runs without a global install.
+- Provenance / trusted publishing badge if available.
+
+### C · GitHub surface
+- Repo description (outcome, ≤ 120 chars), website URL, ≥ 5 topics that match the keywords, social preview image set (1280×640), releases with notes, pinned issue or discussion for feedback, `SECURITY.md`, license detected.
+
+### D · Ecosystem manifests
+- skills.sh / Cursor / Claude / Codex / Gemini plugin manifests: version in sync with the package, description in sync, install command correct on each surface, listing status honest (submitted ≠ listed).
+- MCP registry only if the repo ships a runnable server.
+
+### E · Install path
+- On a clean profile (temp HOME): install one-liner → first successful action; note every prompt, restart, or missing-key stop; time it.
+
+## Report template
+
+```markdown
+# Registry Listing Audit — <package>
+
+## Surfaces checked
+| Surface | URL | Fetched |
+
+## Ten-line verdict (stranger read)
+What it is: … · For whom: … · How to install: … · Missing: …
+
+## Findings
+| # | Surface | Gap | Evidence | Sev | Owner skill |
+
+## Tarball
+`npm pack --dry-run` — N files, X MB; unexpected: …
+
+## Install path
+Steps … · Time … · Stops …
+
+## Handoff
+`enhance-readme` (hero/screenshots) · `docs-writer` (prose) · `deploy-npm` (`files`, metadata) · repo settings (description, topics, preview)
+```
+
+## Guardrails
+
+- **Read-only.** No README, manifest, or repo-settings edits here.
+- **No count-led heroes.** Recommend the outcome sentence; counts go in a badge.
+- **Honest listing status.** "Submitted" and "listed" are different words.
+
+## Chains with
+
+- **`plan-gtm`** → for repo-as-product, this is Phase 1 evidence.
+- **`enhance-readme`** / **`docs-writer`** → apply the findings.
+- **`deploy-npm`** → ship metadata and `files` fixes.
+- **`docs-launch-kit`** → announce the refreshed listing.

package/skills/audit-resilience/SKILL.md

@@ -0,0 +1,153 @@
+---
+name: audit-resilience
+description: >
+  Read-only production-resilience audit: timeouts, bounded retries, circuit
+  breakers, idempotency, rate limits, graceful degradation, PII in logs. Use
+  when "resilience audit" or "will this survive real traffic?".
+license: MIT
+effort: high
+---
+
+# audit-resilience — The "80% Problem" Non-Functional Audit
+
+**Degree of freedom: MIXED** — Phases 1 and 4 `[HIGH freedom]`; Phase 0/2
+surface greps `[LOW freedom — run exactly]`.
+
+Agents nail the happy path (CRUD, passing tests) and silently skip what decides whether code
+survives real traffic: a webhook with no idempotency key double-charges; a fetch with no
+timeout hangs the request; a retry storm with no backoff takes down the dependency; PII lands
+in plaintext logs. This audit finds those gaps before production does.
+
+> **Read-only.** This skill inventories resilience gaps and hands each to the right fix skill.
+> It does not change code.
+
+## How to reason
+
+1. **Observe** — quote the call/mutation and whether timeout, retry+jitter, or idempotency key exists
+2. **Interpret** — hang, retry storm, double-write, or silent catch?
+3. **Classify** — Implemented / Partial / Missing (per matrix row)
+4. **Severity** — payment/webhook without idempotency, or no timeout on a live path = Critical
+
+## Worked example
+
+> **Observe:** `POST /api/webhooks/stripe` inserts a payment with no
+> `Idempotency-Key` / dedupe (`app/api/webhooks/stripe/route.ts:44`);
+> `fetch` to Stripe has no `signal` / timeout.
+> **Interpret:** Stripe retry double-charges; a hung fetch exhausts the pool.
+> **Classify:** idempotency Missing; timeout Missing.
+> **Severity:** Critical.
+> **Finding:** webhook | no idempotency + no timeout | Critical | `backend-patterns`
+
+## Phase 0 — Detect the surfaces  [LOW freedom — run exactly]
+
+```bash
+# Outbound calls + clients
+rg -n "fetch\(|axios|got\(|httpx|requests\.|HttpClient|ky\(" -g "*.{ts,tsx,js,py,go}" -l
+# Mutations / writes / external effects
+rg -n "prisma\.|\.insert\(|\.update\(|\.delete\(|supabase\.|INSERT|UPDATE|DELETE" -g "*.{ts,py,sql}" -l
+# Webhooks / payments / queues
+rg -n "webhook|stripe|paypal|queue|kafka|sqs|bull|cron|schedule" -g "*.{ts,tsx,js,py}" -l
+# Logging (for PII / audit-log review)
+rg -n "console\.(log|error)|logger\.|logging\.|print\(" -g "*.{ts,tsx,js,py}" -c
+```
+
+Record: HTTP clients, external services, mutation/webhook/payment paths, queue/cron jobs,
+and the logging approach. If there are no external calls or mutations (pure static site /
+library), note reduced applicability.
+
+---
+
+## Phase 1 — Research current patterns  [HIGH freedom]
+
+Follow `/research`: current-year resilience patterns for the detected stack (retry/backoff
+libraries, circuit-breaker options, idempotency-key conventions, the platform's rate-limit
+primitives). Anchor to installed versions.
+
+---
+
+## Phase 2 — Resilience matrix (per external call / mutation / endpoint)  [HIGH freedom; greps LOW]
+
+For each surface, mark **Implemented / Partial / Missing** with `file:line`:
+
+| Concern | What to check | Why it matters |
+|---|---|---|
+| **Timeout** | Every outbound call has an explicit timeout | No timeout = hung requests exhaust the pool |
+| **Retry + backoff** | Transient failures retried with exponential backoff **+ jitter**, capped | Naive retries cause retry storms |
+| **Circuit breaker** | Repeated downstream failure trips a breaker / stops hammering | Prevents cascading failure |
+| **Idempotency** | Writes/webhooks/payments use an idempotency key or dedupe | Prevents double-charge / double-write on retry |
+| **Rate limiting** | Public/expensive endpoints are rate-limited per client | Prevents abuse and cost blowups |
+| **Cancellation** | Long/aborted requests are cancellable (`AbortSignal`/context) | Frees resources on navigation/timeout |
+| **Graceful degradation** | Fallback/empty/cached path when a dependency is down | App stays usable, not white-screen |
+| **Error propagation** | Failures surface as structured errors, not swallowed | Silent catch hides outages |
+
+```bash
+rg -n "timeout|AbortController|AbortSignal|signal:" -g "*.{ts,tsx,js}" -c   # timeouts/cancellation
+rg -n "retry|backoff|p-retry|exponential|jitter" -g "*.{ts,tsx,js,py}" -c    # retry policy
+rg -n "idempotenc|dedupe|Idempotency-Key" -g "*.{ts,tsx,js,py}" -c           # idempotency
+rg -n "rate.?limit|rateLimit|throttle|Ratelimit" -g "*.{ts,tsx,js,py}" -c    # rate limiting
+rg -n "catch\s*\([^)]*\)\s*\{\s*\}" -g "*.{ts,tsx,js}"                        # empty catch (swallowed errors)
+```
+
+---
+
+## Phase 3 — Observability & sensitive-data handling  [HIGH freedom; PII grep LOW]
+
+| Concern | What to check |
+|---|---|
+| **Audit logging** | Sensitive/mutating actions (auth, payment, role change, delete) are logged with actor + timestamp |
+| **PII in logs** | No emails/tokens/card data/passwords logged in plaintext; redaction in place |
+| **Structured errors** | Errors carry codes/context (not bare strings); correlation/trace id present |
+| **Health/timeouts surfaced** | Failures are observable (Sentry/logs), not only user-visible |
+
+```bash
+rg -n "password|token|secret|email|ssn|card|cvv" -g "*.{ts,tsx,js,py}" | rg -n "log|console|print"
+```
+
+---
+
+## Phase 4 — Prioritized report (read-only)  [HIGH freedom]
+
+```markdown
+## Resilience Audit — [repo] — [date]
+**Surfaces:** [N outbound calls · M mutations · K webhooks/payments · queues/cron]
+
+### Critical (data loss / double-charge / outage risk)
+| Gap | Surface | file:line | Fix via |
+|---|---|---|---|
+| No idempotency key on payment webhook | /api/webhooks/stripe | ... | backend-patterns |
+
+### High / Medium
+| Concern | Implemented | Partial | Missing | Fix via |
+|---|---|---|---|---|
+| Timeouts | [n] | [n] | [n] | backend-error-handling |
+| Retry+backoff | ... | ... | ... | backend-patterns |
+| PII in logs | ... | ... | ... | backend-observability |
+
+### Recommended order
+1. [Critical idempotency/timeout gaps] → backend-patterns / backend-error-handling
+2. [Rate limiting + LLM cost] → plan-llm-cost-guardrails
+3. [Observability + PII redaction] → backend-observability
+```
+
+**Forbidden:** claiming production-readiness from passing tests alone; treating an empty
+`catch` as handled; skipping the payment/webhook idempotency check.
+
+## Self-critique before reporting  [LOW freedom — do not skip]
+
+1. **Evidenced** — `file:line` on the call, not "probably has a timeout"
+2. **Reproducible** — the Phase 0/2 grep still hits that surface
+3. **Severity justified** — Critical = double-charge / data-loss / pool-exhaust
+4. **Right owner** — implement via `backend-patterns` / `backend-error-handling`; LLM quota → `plan-llm-cost-guardrails`
+5. **No-false-safety** — passing tests ≠ production-ready; empty `catch` ≠ handled
+
+## Related
+
+- `backend-error-handling` — implement timeouts, retries, structured errors, fallbacks
+- `backend-patterns` — circuit breakers, idempotency, queue/retry architecture
+- `backend-observability` — audit logging, PII redaction, tracing, alerting
+- `plan-llm-cost-guardrails` — rate limiting + quota abuse for LLM/expensive endpoints
+- `plan-input-validation` — the trust-boundary validation side of hardening
+- `plan-data-integrity` — destructive-op and data-loss protections
+- `test-load` — prove timeouts/retries under concurrent traffic
+- `audit-ui-states` — front-end empty/error/offline rendering
+- `complete-everything` — close the audited gaps to done with verification